TOP SECRET//CD3\'HHq , //20291123 

Report 05-INTELO3 
December 15, 2004 
Audit Report 

Office of the Inspector General 

of THE 

Department of Defense 




DEPUTY INSPECTOR GENERAL FOR INTELLIGENCE 

Requirements for the TRAILBLAZER 
And THINTHREAD Systems (U//FOTO> 



Spoctai Warning 

Tliit. duuumeut cuuUias lufm maCluH exerupl from mandatory disclosure under the Freedom of 
■ TaformRflon Act Thts report contains certain unclassified infor mattoa relating to the organization 
and function of the National Security Agency that may bo protected by the National Security Act of 
1959, as am e nded (50 United States Code § 402 (note)). Reproduction or removal of pages is 
prohibited. Safeguards mini be t aken to prevent publica t ion or impr o per disclosure of the ■ 
information hi this re p ort. 



DERIVED FROM: NSA/CSSM 1 - 52 copy /£of JO. 

DATED: 23 MuveaiW 2004 
DECLASSIFY ON: 20291123 



TOP SECRET//tOMjF^T//20291123 



DOCID 



325334 6 



TOP SECRET//COMINT//20291123 



Additional Copies (U) 

(U To obtain copies of the report, contact Mr. Thomas F. Gimble at 



Suggestions for Audits (U) 

(U) To suggest ideas for or to request future audits or evaluations of Defense 
intelligence issues, contact the Office of the Deputy Inspector General for 
Intelligence at (703) 604-8800 (DSN 664-8800) or fax (703) 604-0045. Ideas and 
requests can also be mailed to: 



Office of the Deputy Inspector General for Intelligence 
Attn: Executive Officer 
Inspector General of the Department of Defense 
400 Army Navy Drive (Room 703) 
Arlington, VA 22202-4704 



Defense Hotline (U) 

(U) To report fraud, waste, or abuse, contact the Defense Hotline by calling 
(800) 424-9098; by sending an electronic message to Hotline(5?dodig.osd.mil : or 
writing the Defense Hotline, The Pentagon, Washington, DC 20301-1 900. The 
identity of each writer and caller is fully protected. 




at (703) 604- 



(DSN 



(U) 



Acronym (U) 



(U)NSA/CSS 



National Security Agency/Central Security Service 



TOP SECRET//CeiVSNT//20291123 



Per DoD 1(3 



OCIDt 3253346 



TOr SECRET//€OMINT//2029im 




DEPARTMENT OF DEFENSE 
400 ARMY NAVY DRIVE 
ARLINGTON, V7RGMA 22202-2884 



INSPECTOR GENERAL 



December 15, 2004 



MEMORANDUM FOR DIRECTOR, NATIONAL SECURITY AGENCY / CHIEF, 

CENTRAL SECURITY SERVICE (U) 

SUBJECT: Audit of the Requirements for the TRAILBLAZER and THINTHREAD 
Systems (Report No. OS-INTEL-03) (Project No. D2003AL-0100) (U flTQUO) 



(U) We are providing this report for review and comment. This audit was 
initiated from a Hotline complaint. We considered management comments on a draft of 
this report in preparing the final report. Management conducted a security classification 
review of the draft report. 

(U) DoD Directive 7650.3 requires that all recommendations be resolved 
promptly. Management nonconcurred with Recommendations A.l. and A.2. 
Management partially concurred with Recommendations A.3., B.L, B.2., and B.3. As a 
result of management comments, we revised Recommendations A.2.and B.L We request 
that the Director, National Security Agency/Central Security Service provide additional 
comments on all recommendations by January 15, 2005, 

(U ) We appreciate the courtesies e xtende d t o the staff. Questions should be 

directed to^HB^^^Htt (703) 604-^M<»' Hm^la 1 

(41 0) 854-i^H See Appendix K for the report distribution. The team members are 
listed inside the back cover. 



This diHituuent L t mUini iuf o iuialiou exempt from mandatory disclosure tadtr tha Freedom 
of Informati o n Act This report contains certain nnelanifl e d information rotating ta the 
organization and function of the National Se c urity Agency that may be protect e d by the National 
Security Act of 1959, as ameii Jed (50 Unit e d Sta t e* Code § 402 (cot e )). Reprodactkm or removal of 
pages is prohibit e d. Safeguards matt be taktn to prevent public a tion nr tmprflprr riftf tomrf of the- 
information in thit report 




Thomas F. Gimble 
Deputy Inspector General for 
Intelligence 



DATED; 33 N a vwnbtf 3004 
DCCLASSITT OK: 20391 123 



Special Wa i' uhig 



TOP SECRET//COMINT//20291123 



b{6) 

Par DoD 1(3 



TOP SECRET//€&ftBNT7/20291123 



THIS PAGE INTENTIONALLY LEFT BLANK (U) 



L 
L 



DOCID: 3253346 



J 



TOP SECRET//COMINTO2029m3 



/lb) (1) 

/ lb) (31-P.L. 86-36 



Office of the Inspector General of the Department of Defense / 

December IS, 2605 



Report No. O5-INTEL-03 
(Project No. D2003AL-OIOO) 



Requirements for the TRAILBLAZER and TfflNTHREAD 

Systems (U) 



Executive Summary (U) 

(d/./febsi^ ^ who Should Read This Report and Why? Acquisition decision makers at the 

National Security Agency (NSA); the designated NSA Milestone Decision Authority for 
the Under Secretary of Defense for Acquisition, Technology, and Lo$stics; and 
personnel in the Office of the Assistant Secretary of D efense (Networks and Information 



Integration) should read this report 



/the NSA. 7 7 

i (U//F©lfO). Background. We performed this audit in response to a Defense Hotline 
complaint, which alleged that NSA actions in the development of THINTHREAD and 
TRAILBLAZER resulted in fraud, w aste, and abuse. The spec ific allegations were: (1 ) 
TRAILBLAZER development waste d! H ollars: (2) NSA 



disregarded soluti ons to urgent U.S. national security needs: ffl NSA modified or 
suppressed finiriies[ ~~ 
and (4) N SA did hot 

I iTHlNTJjREarr. 



TS#8D THINTHREAD, 




jy/fF&UG) TRAILBLAZER. TRAILBLAZER is an Acquisition Category-lA pro-am 



// to acquire, through a series of spiral developments, an integrated system to mrwidB the 

? much -needed mission capability against the Global Netw orks | 

j "f TRAILBLAZER is beUtg 

' developed. See Appendix B tor further details. 



'(b) (3)-P.L. 86-36 



(b) d) 

(b) (31-P.L. BS-36 



TOP SECRET#CefflTJffT//2 9£9»33- 



DOCID; 3253346 



lb) (1) 

(i>| (3)-50 USC 403 
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(b) (3)-P.L. 85-36 



flS^JResuIts. NSA enhanced existing digital network exploitation systems,] " 



1 the National SecurityN 

Agency is inefficiently using resources to develop a digital network exploitation system 
that is not capable of folly exploiting the digital net work intelligence available to analysts 
from the Global Information Network. NSA should! 



lb) (3!-P.L. 

(b) (5) 



B6-3S 



S \ 



nvmxm\ NKA immanent j 



jigital network exploitation for the TRAILBLA^gL 
^Technology Demonstration Piatfdnt 
forr 



As a resultj the NSA transformation effort may be developing a less capable long-term 
digital network exploitation solution that will take longer and cost significantly more to 
develop. NSA management should designate a team to assess! 
— - j j tne processing and 



exploitation requirements of the TRAILBLAZER Technology Demonstration Platform. 
-Also, NSA .management should provide the results of this assessment to the 
TRAILBLAZER Technology Demonst ration Platform Milestone Decision Authority for 
use in making the Milestone B decision 1 



(11) Management Comments and Audit Response. The management comments form 
..the Director, NS A/Chief; Gefltral Security Service contained significant disagreements 
with the report findings. The Director stated that the world's most advanced cryptologic 
experts have assessed the.situation and are confi dent in the approach NSA has taken. The 
DiVecto^ non concurred with the recommendation/ 



concurred or partially concurred with me recommendations to 

I \ _ . '•■ _ m ~~7 

and include this assessment as part of the TRAILBLAZER Milestone B decision. The 
Prograai Executive Officer and TRAILBLAZER management will estimate the 
cost/schedule impacts after they receive estimates from the review team and will decide 
at that tioie whether to concur. Three of the four partial incurrences depend upon the 
Program Executive Officer arid TRAILBLAZER mwwppment decisidri 



Xy)>We revised me; report findings and reco mmendations based on the Director's 
comments. However 1 .; we continue to helievef 



We request that the NSA/Chief, CentraT 



Samrirv Sepflce^ffOVid e} ~~~ 

We do n ot agree with management taat it would be detrimental to the 



signals intelligence missioi 
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'{b> (3)-P.L. 36-36 



(U)| , I We request that the Director, 



NSA/Chief, Central Security Service provide additional comments to this report by 
January 15, 2005. See the Findings section of the report for a discussion of management 
comments and audit responses, Appendix J for a detailed audit response to the 
management comments, and the management comments section of the report for the 
complete text of the comments 
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(U) Background 



(b) |3) -P. L. 86-3S 



^eyfiotline Allegations. A letter to the Defense Hotline requested that the 
Inspector General of the Department of Defense audit and investigate the 
acquisition of the TRAILBLAZER and THINTHREAD programsAthecpmplaint 
charged the NSA with fraud, waste, abuse, and a disr egard for a solution to. u rgent 
security needs because the TRAILBLAZER Program! 



NSA ignored or modified the recommendations or two technology studf 



A1S 6: the 



(U) National Security Agency Mission and Planning Guidance. The mission 
of the National Security Agency/Central Security Service (NSA/CSS) is to 
provide actionable Signals Intelligence to U.S. decisionmakers, from the national 
to the tactical level, while protecting the nation's vital information from attacks. 
The urgency of the NSA/ CSS mission is greater than ever since the September 
1 1 th attacks and the Global War on Terrorism . 

(U/7FOHQ^Jn addition, defense planning guidance and the Director of Central 
Intelligence guidance stipulate the need for "a globally vigilant intelligence 
system that can provide early strategic warning of crisis and detect threats" that is 
supported by capabilities such as an ''information superiority backbone." 



_(gffSI)_TRAILBLAZER is s | m ajor acquisition program, which 

started in FY 2000 and is scheduled tor initial operating capability in FY" 2009, to 
acquire an integrated system that is composed largely of commercial technology 
to provide the much-needed mission capability against the global network through 
a series of spiral developments. The TRAILBLAZER system will deliver 
hardware and software, system integration, and program integration services to 
include: 
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'(b) (3)-?.L. 86-3S 



(b) (1) 

(b)(3)-P.L. 86-36 




'(B'rf31-'P-.-i._.a5.-36 



l'L'f : T3-):€g;.rE--8G-3&- — 



fU) Policy Governing 



Requisition. Guidance for 

[acquisition is provided in DoD Directive 5000.1, 

' DoD Instruction 3UU0.2, and the dinger Cohen Act of 1 996. Specifically, these 
regulations provide the framework for the acquisition of major automated 
information systems. 

(U) DoD Directive 5000.1, "The Defense Acquisition System," May 12, 2003. 

DoD Directive 5000. 1 establishes the management process by which the DoD 
provides effective, affordable, and timely systems to the users. DoD . 
Directive 5000.1 states that all acquisition professionals shall continuously 
develop and implement initiatives to streamline and improve the Defense 
Acquisition System. Specifically, this directive states that military decision 
authorities and program managers shall examine and, as appropriate, adopt 
innovative practices that reduce cycle time and cost and encourage teamwork. 
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(U) DoD Instruction 5000.2, "Operation of tide Defense Acquisition System," 
May 12, 2003. DoD Instruction 5000.2 establishes a management framework for 
translating mission requirements into stable, affordable, and well managed 
acquisition programs that include weapon systems and automated information 
systems, and highly sensitive classified, cryptologic, and intelligence projects and 
programs. Instruction 5000.2 states that, during me initial concept design, DoD 
Components should examine multiple concepts and material approaches to 
optimize the way that DoD provides these capabilities. That approach shall 
include robust analyses that consider affordability, technology maturity, and 
responsiveness. 

(IT) Clinger-Cohen (Information Technology Management Reform) Act of 
1996. This act requires that heads of executive agencies develop and use best 
practices in the acquisition of information technology. The process of an 
executive agency shall include minimum criteria to be applied in considering 
whether to undertake a particular investment in information systems, including 
criteria related to the quantitatively expressed projected net, risk-adjusted return 
on investment and specific quantitative and qualitative criteria for comparing and 
prioritizing alternative information systems investment projects. 

(U) NSA/CSS Circular 5000R, "Acquisition Management," January 9, 2001. 

The circular implements the principles of DoD Directive 5000.1 and DoD 
Regulation 5000.2-R within the NSA/CSS. It establishes basic objectives, 
policies, procedures, and responsibilities for acquisition management. The 
circular states that for acquisition management within the Defense Cryptologic 
Program, NSA should address interoperability between existing and future 
Service tactical Signals Intelligence systems, connectivity between tactical and 
national systems, consider applicable technology that may satisfy the requirement, 
and possible duplication of ongoing effort. 

(U) Objectives 



flJ/TFOtJQI The overall audit obiective was to evaluate 




We 



did not review the management control program. See Appendix A tor a 
discussion of the scope and methodology. 



(b) (3J-P.L. 86-36 
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(b) (1) 
(b) (3)-50 USC 403 
(b) (3>-'p.L. 86-36 



THINTHREAD (U) 



(b) (1) 

(b) (3>-P.L. 86-36 
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(U/f¥ W3m TRAILBLAZER 



(S'5-:r3-)'-P-.i.- -B 6-3.6 



/(b) (1) 

/ (b) (3J-P.L. 86-36 



(TQ//SI) The TRAILBLAZERI IJm initiative that 

... began in March 2001 at a cost of approximate^ focused on a set of 

"efforts to demonstrate essential capabilities and 6Sla&liSft an initial Operational 
CapaBility by June 2002 that would lead the transformation of NSA into an era of 
effective arid efficient digital networic exploitation. The im mediate objective of 
the TR A 1L8LA ZpRi 



(b) (1) 

(b) (3) -50 USC 403 
(b)(3)-P.L. 86-36 
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•(b) (1) 



(b), (3) -50 USC 403 
(b)\3)-P.L. 36-36 



(b) (3)'-P.L. 86-36 
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'(b) (1) 

(b). (3) -50 USC 403 
(b)''(-3)-P.L. 86-36 
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(b) (1) 

(b) (3)-50 USC 403 
(b) (3) -P. L. 86-36 
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(U//F9^JjQX.Techiiical Review Studies. A number of internal and external technical 
review studies were conducted to determine! \ 



(b) (3)-P\.L. 86-36 
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(b) (3) -50 USC 403 
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(U) Internal Reviews 
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(b) (31-P.L. 86-36 
kb) [5) 



i 



'(b) (1) 
■(b) (3)- 
(b) (3)- 



conclusions and recommended that: 



(tl) External Reviews 



(V/fFQVG$ 



■50 USC 403 
■P.L. 86-36 



] 
] 
] 
] 
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(UHFWm Recommendation: 



(b) (3)- 
(b) (5) 



■P.L. 86-36 



A 



L 



Co! (1) 

(b) (3)-5Q USC 403 
(b)(3)-P.L. 36-35 
(b) (5) 



(b) (1) 

(b) (3)-50 USC 403 
(b) (3) -P.L. 86-36 



-gy/GIZ/REE) RectmuaencUtiMi: 



-XSfiSffNSA Modernization Studies. The first "NSA Modernization Study," 
July 2001, was conducted fay The National Technology Alliance, National Center 
for Applied Technology after a thorough revie w of ongoing activities within the 
TRAELBLAZER Program Management Offic^ 
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(U) The NSA Modernization Study recommended that: 



(b) (3)-P.L. 

(b) (5) 



• (uz/Foue)- 



L 



-36 



(U/7F©yQ) The National Center for Applied Technology issued a second report, 
a "quick-look" follow-on to the first report, in December 2001 . The Chief, 
Signals Intelligence Programs invited the original study team to conduct a follow- 
on study to evaluate progress within the TRAJLBLAZER Program Management 
Office. Despite noting some changes made in NSA management and the 
TRAILBLAZER Program's acquisition strategy that promised to address the 
conflicts and issues noted in the first report, the study team found that: 



(3J-P.L. 86-36 



(b) (1) 

(b) <3)-50 USC 403 
(b) (3)-P.L. 86-36 



(b) <3)-P.L. 



86-36 
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:b)(3)-P.L. 85-36 
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(b) (1) 

(b) (3)-P.L. 86-36 



(b) (3J-P.L. 86-35 
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(b) {3J-P.L. 



86-36 
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(b) (1) 

(b) (3) -P.L. 86-36 
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(TS/?Si^Studies. Prior to THINTHREAD deployment, the Technology Test and 
Evaluation Assessment, Ma rch 25, 2002, advised that the follovgng f ~ 



A 


actions be addressed:. " 






TbT(3) -P.L. 86-36 
< b .X 5 .' 




• 


(U) Generate user, system, technical, and programmatic documentation; 


""•-■••».. 




'x • 


fU) Acquire sufficient numbers of anpropriatelv skilled oersonnel to 



develop documentation, V 



] 
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(b) (3J-P.L. 86- 
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(U) Summary 



(U) Management Comments on the Finding and Audit 
Response 

(U//FOtfO) Management Comments. The NSA management stated that the 
draft report did not include significant information or included wrong or 
misleading information. The complete list of management comments is in the 
Management Comments section of this report 

23 
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(U//?t)©Ct)L Audit Response. We obtained, reviewed, and analyzed many 
documents and we interviewed several NSA and contractor personnel to form the 
conclusions in this report. We included all information relevant to support the 
report findings and recommendations. Many people we interviewed asked not to 
be identified for fear of management reprisal. We gathered information from 
many sources to support the finding. Paragraphs frequently contain information 
from several sources to reinforce conclusions. Based on management comments, 
we made various editorial changes to the draft report. See Appendix J for a 
completed audit response to each management comment. 



(U) Recommendations, Management Comments, and Audit 
Response 



(U) A. We recommend that the Director, National Security Agency/Chief, 
Central Security Service: 



(b) (I) 

(b) (3)-P.L. 86-3G 
(b) (5) 



-flSWSfrMsrasgement Comments. The Director, National Security Agency/Chief, 
Central Ser nritv Servir.fi imnrr>nr.»m>rl and stated that the systems engineering 
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H(S#Si) Management Comments. The Director, National Security Agenc#/Chi^f, 
Central Security Ser vice T|oncnncmT<yt because die National Security Agency 
management believes tha 



\ Management did not understand what was meant fryf 



-fiS#SI^Audit Response. Based on management co mments, we revised the 
recommendation to explain more clearly the meaning] 



25 

TOP SECRET//COIVII?rr//2Q291123 



DOCID: 325334C 



lb) (1) 

(b) (31-P.L. 



86-36 



TOP SECRET//COMINT//20291123 



■ (TC//0I) th at the National Security Agency management Teconsider its position 



3.feJ~ 



(U#FOt*Q)-Management Comments. The Director, National Security 
Aprencv/Chtftf Central Sqcimft/ Kervire cfinciirrffH Tn Anril 700V MS A nmvi^ed 



...(Ufi rcUQ) -^-Audit Response. Management comments wnr, narfiallv rrennnsivp: 
Although the National Security Agenc] 



(b) (3) -P.L. 86-36 
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| j (b) (3)-P.L. 86-35 
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B. The NSA Transformation (U) 



(U) Congressional Concerns on Digital Network Exploitation 

(U) The National Defense Authorization Act for FY 2002 stated that: 



(b) ( 
(b) ( 
(b) ( 



1} 

3>- 

3)- 



•50 USC 403 
•P.L. 86-36 



-CTS//GI) The NSA has clearly made great strides in seeking to 
transform itself in many areas. However, the NSA appears to have 
made only modest progress in lbs area most important to its future: 
acquiring the technical ability to operate effectively against the 
emerging global network. The NSA has long known that 



(U) TRAILBLAZER 



- (S // S I) On March 24, 2000, the Director, NSA signed the TRAILBLAZER 1 
charter to'create a new Signals Intelligence enterprise to exploit the global 
network. TRA1LBLAZEEJ, with an estimated development cost of 
approximately vas to respond to the opportunities and challenges 

provided by emerging lecnnblogies to design new operational practices for on- 
time delivery of products and services in the manner that best met customer 
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(SJ^SIXneeds-unrestrained by past practices or past technologies. 
TRAILBLAZER 1 had the following key responsibilities 

• (Uff POUQ) Ensure the execution of a new NSA program transforming 
the U. S. Cryptologic System exploitation of the global network. Map 
detailed digital network exploitation mission requirements to a 
cryptologic architecture and implement them; and 

• (U/yi ? OUQ). Act as the catalyst for transforming customer interaction 
and operational practices. Begin the retooling of NSA 
programmaticalfy, technologically, and culturally to provide mission 
services and capabilities that are responsive to the emerging 
technology and customer needs. 



(b) (1) 

(b) (3)-50 USC 403 
(b) (3J-P.L. 86-36 



TRAILBLAZER 




28 

TOP SECRET//COMINT//20291123 



"J 
1 
1 
1 
1 
1 
1 
"J 
"J 
J 
J 
J 
J 
J 
J 



iDOCID; 3253346 



TOr SECRETWCQjVBmy/20291123 



(b! (1) 

(b! (3)-50 USC J03 
(b) [3J-P.L. ?S-36 



(U) NSA Modernization Studies 

"''H)§M^t'NSA-.Modeniizatton Study. The House Permanent Select Committee 
on'Thtelligence directed. the first "NSA Modernization Study," July 2001 , which 
was conducted by The National Technology Alliance, National Center for 

Applied Technology. After n fhnmmjrti rftvifw nf nngninu ntrHvitire within fn» 

TRAIL BLAZER Program Management OfficeL 



wd interviews with key program personnel, the National Center for 
Applied Technology team observed fifths TRATr.BT.AZER wasnonrtv 



executed and had an overly expensive 
The NSA Modernization Study reconunenaea mat" 



~{S#Kr) Second NSA Modernization Study. A second National Center for 
Applied Technology report, a "quick-look" follow-on report, was completed in 
December 2001 . The Chief, Signals Intelligence Programs invited the original 
study team to conduct a follow-on study to evaluate progress within the 
TRAILBLAZER Program Management Office. Despite noting some changes 
made in NSA management and the TRAILBLAZER Program acquisition strategy 
that promised to address the conflicts and issues noted in the first report, the study 
team found that: 
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(U) NSA Technical Reviews 

(b) (l) ~tS#Sf> During FY 2001 , NSA initial and followup internal technical reviews 

(b) (3)-50 USC 403 \ 
(b) (3J-P.L. 66-36 



x(U) TRAILBLAZER Acquisition 



30 

TOP SECRETflraMBOr//20291123 



rDOCID; 3253346 

TOP SECRET// CO M I N T/ /2Q291123 

] 
] 

] ' / 

V 

(b) (1) 
" (b) (3)-50 USC 403 
Jb).(3)-P,L. 86-36 

] \ 
"J 

" | 

i 
i 



31 

TOP SECRET ?7 C OMINiy/20291123 



DQGIDi 3253346 

TOP SECJ(ETfJUOmm//2Q29im 



(b) (3)-P,L. 86-36 



(b) (1) 

(b) (3) -50 USC 403 
(b) (3)-P.L. 86-36 



(b) (3)-P.L. 86-36 
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<b) (1) 

(b) (3)-5Q USC 403 
(b) (3)-P.L. 86-36 



(U) Conclusion 



-fS#Sf^RAILBLAZER was develnpe ^tn create a new Signals Intelligence 
enterprise to exploit the global network 
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(b) (1) 
(b) (3)- 
(b) (3}- 



■50 USC 403 
•P.L. 86-36 
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(U) Summary of Management Comments on the Audit Finding 
and Audit Response 

(U//FOC©)- Management Comments. NSA management referred to several 
statements in the report that did not include all referenced documents and that 
some paragraphs contained wrong or misleading information. The complete list 
of management comments is located in the Management Comments section of 
this report. 

(U//FDU9) Audit Response. We obtained, reviewed, and analyzed many 
documents to form the basis for the conclusions in this report. We also 
interviewed several NSA and contractor personnel, many of whom asked not to 
be identified for fear of management reprisal. We gathered information from . 
many sources to support the finding. Paragraphs frequently, contain information 
from several sources to reinforce conclusions. See Appendix J for a complete 
audit response to each management comment. 

(II) Recommendations, Management Comments, and Audit 
Response 



Mb) (1) 
(b) (3>- 
(b) (5) 



P.L. 86-36 



(fc^ Revised Recommendation. As a result of management cbmmeiits, we 
revised Recommendations B. i and B.3 to clarify the intended .nse of V\ 



1. QUMr&&Q±Sre recommend that the Director, National Security 
Agency/Chief, Central Security Service: 




Management Comments. The Director, National Security 
Agency/Chief, Central Security Service partially concurred with the intent of the 
recommendation but was waiting for the results of a cost and schedule impact 
study before fully concurring. The Program Executive Office is establishing an 
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(b) CD 

(b) (31 -50 USC 403 
(b) (3)-P.L. 86-36 



(U//FOB©) independent review team to complete the study before Milestone B, 
scheduled for December 2004, because the study will have an effect on both the 
cost and schedule for Milestone B. 



Audit Response. Based on management comments, we revised this 
recommendation. The Director, National Security Agency/Chief, Central 
Security Service comments were responsive and the proposed actions meet the 
intent of the recommendation. The immediate actions taken to designate an 
independent review team to perform the assessment are commendable. 
Milestone B has slipped to Febr uary 2005 at the earliest: therefore. NS A will have 
time to complete the assessment! 



1 KAtLBLAZiSK. We request that tne Director, National security Agency/cnret, 
Central Security Service provide a risk mitigation plan for cost and schedule 
requirements and provide comments on a final concurrence. 

2, (U//FOTJO)-Provide the results of the external assessment to the 
TRAILBLAZER Technology Demonstration Platform Milestone Decision 
Authority for use in making the Milestone B decision. 

(U//F€RlQ£Management Comments. The Director, National Security 
Agency/Chief, Centra! Security Service concurred. The completion of the 
independent assessment is currently scheduled for December 2004. 

(U//FOtfO}LAudit Response. Although the Director, National Security 
Agency/Chief, Central Security Service concurred, the concurrence is based on 
completing the assessment requested in Recommendation B.l. We request mat 
the National Security Agency management provide additional comments in 
response to the final report identifying NSA plans to eliminate the cost and 
schedule risks for completing the assessment, 



(b) (1) 

(b) (3)-P.L. 



(U//FOU©) Management Comments. The Director, National Security 
86-36 Ageney/ClnefrGentr^^ andflfaffti that fbei assmsmfinf 

-- required in Recommendation B. 1 will be included in-th< 

for Milestone B, scheduled for December 2004. 

(S//SI) Audit Responses Although the Director, National Security Agency/Chief, 
Central Security Service concurred; uie-concurrence is based on completing the 
assessment requested in Recommendation B.T; Based on mnnnpftrrtfint mmmmts 
to Recommendation B.2.. this recommendation was revised! ' 
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■I'SflSIj J ^ I We request additional 

comments in response to the final report identifying NSA plans to eliminate the 
cost and schedule risks for completing the assessment. 



'(b) (1) 

(b) [3)-P.L. 86-36 • 
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(b) (1) 

Appendix A. Scope and Methodology (U) |\ 

(U/flr©tJe}-We reviewed documentation dating from November 200Q through 
October 2003 including background information, mission and operational need 
statements, concepts and operational requirements, and contracting and budget , 

documents. AISO, We Conducted inforviftwa with nrnaram manatrm njttflWe W>r 

, technicians resnoriisihie for the acmnsittonl 




(U) We performed this audit from April 2003 through May 2004 in accordance 
with generally accepted government auditing standards. \ \ 

(U/7F6tJ0fLinritarion to Scope. Because our objective was limited to ■ 

evaluating a Defense Hotline allegation relating to the acquisition of the \ 

TRAILBLAZER and THENTHREAD programs, we did not review the \ \ 

management control program.1 \ 



(U) Use of Computer-Processed Data. We did not use computer-processed! 
data to perform this audit. \ 

(UtfFetJQ) Use of Technical Assistance. Audit Follow-up and Technical \ 
Support Personnel assisted us during the audit. The Technical Assessment 
Division assisted in the analysis of NSA acquisition! 



(U) General Accounting Office High-Risk Area. The General Accounting 
Office has identified several high-risk areas in DoD. This report provides 
coverage of the Infrastructure Inefficiencies and Information Technology 
Investments high-risk areas. 

(U) Prior Coverage 



(U//FT3yQXPuring the last 5 years, the Inspector General of the NSA issued one 
report on TRAILBLAZER that discussed improperly based contract cost 
increases, non-conformance in the management of the Statement of Work, and 
excessive labor rates for contractor personnel. No prior coverage has been 
conducted on the NSA THINTHRBAD Program during the last 5 years. 
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(U) Inspector General, NSA 

{U//PDyO)JReportNo. ST-03-0014, "TRAILBLAZER 1/SIGINT Programs 
Systems Engineering and Technical Assistance Contract," September 30, 2004 
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Appendix B. TRAILBLAZER (U) 




(U) Objectives of TRAILBLAZER and the Technical 
Demonstration Platform 



(b) (3}-P.L. 86-36 




(U//FQU©) Common standards and interfaces throughout the NSA 
Reference Model. 




■JSUSfy Specifically, the TRAILBLAZER frameworic must leverage the best 
commercial technology and nractices. It also must be standards based to 
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(b) (3J-P.L. 86-36 



(b) (1) ' 
.(b) (3)-50 USC 403 
(b) <3)-P.L. 86-36 
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(b) (3) -50 USC 403 
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(b) (1) 

(b) {3)-50 USC 403 
(b) (3) -P.L. 86-36 
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(U) Technical Recommendations 

(U) The Tiger Team made the following recommendation. 



(b) (1) 

(b) (3) -50 USC 403 
(b) (3)-P.L. 86-36 
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(b) (3J-P.L. 86-36 



(b) (1) 

(b>,(3)-P.L. 86-36 
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./(b) (3J-P.L. 86-36 
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(U//F6Be)l ItHINTHREAD 



Technical Review 
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(U //FOUO) Summary nf Sfti riv Recommendations.. Hie foll owing is complete 
list of recommendations ofthe ] [THINTHREAD 
Technical Review: " 



"(b) (3) -P.L. 86-36 



(tJ) NSA Modernization Follow-Up Study 



-[SffS$-The "NSA Modernization Study," July 13, 2001, apHtWNSA 
Modernization Follow Up Study," December 2001, stated 




(b) (1) 

(b) (3)-P.L. 86-36 
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(b) (1) 

(b) (3)-E.L. 86-36 
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{ J>7 T3->— EVL.. __86_- 3 6 



(U) 



(b) (1) 

(b) {3)-P.L. 86-36 



n 



(U) THINTHREAD: 



(b) {3J-P.L. 96-36 



I 



1 
1 
1 
1 
1 
1 



(U) Preliminary research on THINTHREAD was performed by the Test, 
Technology and Evaluation team in February 2002, but the formal evaluation was 
executed from March 1, 2002, thrpu^i March 18, 2002. 



(U) Summary of THINTHREAD 
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(U) General Recommendations. 



(U//FeuG) Hie 
recommendations 



Assessment Study made the following 



(b) (3)-P.L. 66-36 



(10 generate user, system, technical, and programmatic documentation. 



(U) For further details": listed belo w are the seven kev findin gs and related 



jReport. 



discussions in the THINTHREAD 
(U) Finding 1 Discussion. 

qj//Feya> There were no technical issues that wou ld prevent THINTHREAD 



• (U) Current THINTHREAD system development procedures were 
effective, and a cooperative development effort was proceeding smoothly 
with the pilot site. 



74 



TOP SECIUDT//COMiyT//20291123 



1 
1 

1 
1 
1 
1 
1 
1 
1 
1 
1 
1 

1 
1 
1 
1 
1 
1 



F 



OCID: 325334G 



TQr SECRET//CQ^g?fT//20291123 



(b) (3J-P.L. 86-36 




(U) Recommendations. There were no recommendations. 
(U) Finding 2 Discussion 




(U) Recommendations. See the recommendations for THINTHREAD Findings \ \ 
3 through 7 to address these risks. 1 \ 




• (U) some THINTHREAD files could not be viewed to pursue corrective 
actions. 
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(UZ/ggBQ 1 ) Recommendations. The issues previously mentioned would not 



(p) Finding 3 Discussion 



< T^t3.>^.L. 86-36 



(U) There was minimal user, system, technical, or programmatic documentation. 
The existing documentation was insufficient to support the planned deployments, 

• (U) There was no user documentation on how to use the tool. That was 
inefficient and could lead to a significant increase in user error. 
Difficulties using the toot can also lead to an increase in support calls that 
drained project resources. 

• (U) THINTHREAD did not have a clearly stated, documented set of 
mission goals or objectives. There was no program plan, making it 
difficult to communicate information about THINTHREAD at a 
programmatic level. 

• (U) A detailed schedule including all activities related to the system and 
deliverables before, during, and after deployment was not available. A 
high-level schedule containing the chronology of deployment was 
developed, but a detailed schedule was essential for proper resource 
management, costing, and prediction. 

. .- • (U) No installation and maintenance documentation was completed for 

~* •sit§j5upport personnel, although the team was working with the pilot site 

to dev^lop&stallation doc umentation, lack o f insfaifafinn anri 



maintenance docum entation 



(U) There was nq operational support documentation . 

Lack of support document ation could adversely affect timely correction of 
nrohlems and conTj lead tc j 



(U) The effects of minimal documentation could be overcome if an integrated 
team accomplished the development and deployment of THINTHREAD. 
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(U//F©¥Q). Recommendations. Develop necessary documentation. That would 
necessitate an increase in the personnel devoted to documenting the system, but is 
essential to the successful deployment and operation of THINTHREAD. The lack 
of this documentation presented a serious risk to the successful deployment of 
THINTHREAD. \ 

(U) Finding 4 Discussion 



"£*>)-..< 3) -P.L- 86-36 



(U//F QUQ1 D eployment planning was slow to occur 



(U//FeUQXHistorically, the THINTHREAD Program Team focused on 
the prototype demonstration at the pilot site. The program's scope did not 



• (U//FDUQ) The THINTHREAD Program Team did not have a 
comprehensive planning process. The lack of planning activities with 



delayed deployment efforts and increased deployment costs. 



aoperai 



.tion 



(U//F©tJe) Wcwk roles essential to system deployment and oj 
were not identified I 

relationships between work roles throughout the system's life cycle were 
not defined. The authorities for each work role had not been identified. 
The organizational structure set forth by the THINTHREAD Program 
Team focused on system development, and did not address system 
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Sloymemf 
he THIN 



I'HREAD Program 1 earn was detinrng the 



additional work roles necessary for deployment activities. 



• (U) THINTHREAD did not identify all the organizations requiring 
coordination through the various stages of deployment. 

(U//ltH£JCUJtecornmendations. The findings presented a serious risk to 
successful deployment of THINTHREAD. To mitigate those risks, the following 
recommendations were suggested. 



(b> f3)-P.L. 86-36 
(ta) (5) 



(U) Finding 5 Discussion 



(i MFOUO^ Jne customer service and user support processes for THINTHREAD 
were manually intensive and directly involved the technical staff. 



(U//S f 6fc?©) ' riie quality of service and sa pport-Eeceivedf 



ing 

by 



(b) (3)-P.L. 66-36 



{interview 

"TestTtechriology and Evaluation Team viewed tiie 1 rliNTHREAD 
Prnpram Team to he unresponsive in general customer support, while 

- j .._ { experienced good respons iveness to their requests for 

additions or mbdificationsl ! 



(U// FQU Q) There was no formal trouble ticket mechanism in place. If a 
user or operator had a problem with THINTHREAD, he contacted 
someone on the THINTHREAD Program Team. This contact depends on 
personal acquaintance, because no list of THINTHREAD personnel was 
readily available, and there was no mechanism to locate the proper 
THINTHREAD contact Similarly, the status of the response to a request 
could only be learned by personal contact. 

(U/7FOU8)- There was no formal mechanism for managing externally 
generated requirements, to include submitting a new requirement to 
THINTHREAD or for following the progress of the work. 
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m//Fnrffl^A single nftrso n nn the THINTHREAD team was in charge of 

With just a few users, 



(b) {3)-P.L. 86-36 



maintainin g 

—that person was able_tojejiter.ox£hange becording to user 

requests-received oh the telephone or by e-mail. However, as more users 
are added, one person may have difficulty meeting the increased demand, 
^e-lack of personnel may become a p roblem as THINTHREAD was 
scaled to handle an increased user loadf 




(U//F€ftJ©) A list of Web interface functionalities proposec 
was not incorporated into THINTHREAD. 



(U//F9UQ) Recommendations. The findings that led to the recornmendatkina_ 
would not have m-eyevnteA the successful deployment ofTHINTHREAI 
J The recommendations were made to-im prove flie 



oikrijiorial erhciency of THINTHREAD afjetit-was' deployed 



» (^.ftistitatgan-autefiated, formal THINTHREAD customer service and 
; :.::user 'Support process. 



--.--(U) 



(b) (3)-P.L. 86-36 



(U//F6y0) Acquire and use a trouble ticketing tool, which can manage 
extern ally generated requirements as well as system problems. This tool 
"should } " [ The THINTHREAD 

Program Team should address high-priority requirements that fit within 
the program scope. 



(tlYfifeye jon a nmness fp address Web interface functional enhancements 
' requesteq . 



(U/yffdtJG) Address the lack of TyTsmmpl depth in the THINTHREAD 

Program Team, fo r mafatainina ps THIN THREAD is scaled to 

handle more uset a - | 



(U) Finding 6 Discussion 



(U/yFOUO) There was no process for controlling and measuring operational, 
programmatic, and technical performance effectiveness of THINTHREAD, once 
deployed. 

• (U//F6SQ) THINTHREAD did not have a clearly stated set of system 
specifications or a method to validate the THINTHREAD concept or 
performance results. Thus, there was no way to determine if the system 
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(6U// F0U0 } was successful or if it failed, which may lead to confusion in 
stakeholders' understanding of the success of THINTOREAD. 

• (U//F©U0)-THINTHREAD had mechanisms for assessing progress and 
status within the system development phase. However, there were no 
systematic, consistent mechanisms for overall program measurement, 
which included identifying test criteria, establishing program schedules, 
and documenting a system baseline to address progress. No feedback 
mechanisms had been identified such as risk management or contingency 
planning. 

• (U//FOUO) Aside from schedule control, there were no tools to measure 
progress towards program objectives because there were no formalized 
program objectives. 

• (TJ//F6iye-) THINTHREAD did not have Standards of Performance 
established for personnel developing THINTHREAD. If future 
THINTHREAD development crosses organizational groups, a common set 
of Standards of Performance for personnel may become necessary. 

• (U//F©UO) There was no configuration management process, w hich could 
pose a risk when reporting system problems and correcting them ' 




extremely risky. 



(lWF0t?9) The fault or warning detection was automated hut the 
necessary reactions and responses were not- 



software provided asimple way to check status ot various system 
parameters tiirough a Web- mrerfece. However, when an operator 
recognizes" a problem,' hie must actively initiate corrective measures. 
Sometimes that' action is a simple matter, such as restarting a process. At 
"" ojther times, physical hardware must be changed. No corrective action 
could be executed if an operator was not present to initiate a corrective 
action. 



»~-<^/Fe«e)-THINTHREAD had no established process for managing 
requirements. 

(U/ /FOUO) "Recommettfadons.^ that led to me recommendations 

would not have preven ted the suw^ful deployment of THINTHREAD to 

[ "| The recommendations wereTSadetp im prove the 

nnerational efficiency of THINTHREAD after it was deployed ! ~ 
\ The following is a list of recommendations. 



Qdt/BS&O} Develop processes and acquire automated tools based on 
clearly stated specifications for controlling and measuring the 



pmgraTttm ijttc nnerntinns^ and technical performance of THINTHREAD 
pfoyi 



depToymeh 
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(U// FQUO) Acquire a commercially available configuration control 
system to enable versioning, rollback, and configuration management 
The system should interface with the trouble ticketing systefti and the 
requirements management system to provide'full traceability.\ 

(U//Fet*0} Develop Standards of Performance (if fotureT^rirrHREAD 
development crosses organizational groups). \ 

(U//F8tfO^ Automate re actions' and responses to the existing fault and\ 
warning detection system),. -'" — — — — 



• (UffF&UG) Establish a require ments management process for 
^THlNTH pAD that is linked to | 

(U) Finding 7 Discussion 



(bi (3J-P.L. 86-36 . 



fU//FQUOVTbe number and skill mix ofTHINTHREAD personnel was 
inadequate/ 



There were shortfalls with the num bers and skills of pers onnel required for 

Tjlanning-and executing-installations ^lso, there was a lack of 

documentation, providing the necessary maintenance and help .desk support, 
configuration management; and-p!animig.gndj5cheduling. C ollectively, tho se 
gTinrhywrwrms cp&ateA a serious risk to successful completion 



Recommendations. The finding presented serious risk to successful 
deployment ofTHINTHREAD. It was recommended to continue to identify and 

acquire the number and tvnps of skilled nerennnel resources required for 

documentation,! ; 



(fo)[3)-P.L. 86-36 
Co) C5) 
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(b) (1) 

(b) (3J-P.L. 86-36 



(IT) System Capabilities Overviews < b > (3) ri ^ 86 35 

(U/ffeffey The following section outlines the strengths! 
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(b) (1) 

(b) ( 3 ) -P . I/. 86-36 



>b) (3) -P.L. 86-36 
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(U) Cost Analysis ,..- Hi,- < -^.. e ,L. se-36 \ 

(U) The following hypothetical scenarios illustrated Kbw \ 

I I nlay produce a more effective result in terms of both complexity and cost. 
A few assumptions apply: \ 
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(U) Conclusion 
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Glossary (U) 



JNCLASSIFIEDZ/ ron! cutioial uac 
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WITH REST OF DOCUMENT 




.. 86-36 



1 
1 
1 
1 
1 
1 



Consultative Committee for International Telegraph and Telephone (CCITT). 

Consultative Committee for International Telegraph and Telephone is the International 
organization responsible for the development of communications standards. Now called 
the International Telecommunication Union Telecommunication Standardization Sector. 
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(U) 



Kb){3)-P. 



.. 86-36 



Electronic Industries Association (EIA). A group that specifies electrical transmission \ 
standards. The Electronic Industries Association and Telecommunications Industry \ 
Association have developed numerous well-known communications standards, including 
Electronic Industries Association and Telecommunications Industry Association -232 and 
Electronic Industries Association and Telecommunications Industry Association -449. 
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j[b)(3)-P. 



86-36 



International Telecommunication Union Telecommunication Standardization 
Sector (ITU-T). International body that develops worldwide standards for I 
telecommunications technologies. The International Telecommunication Union 
Telecommunication Standardization Sector carries out the functions of the former ! 
Consultative Committee for International Telegraph and Telephone. I 

International Organization for Standardization (ISO). International organization that \ 
is responsible for a wide range of standards, including those relevant to networking. The \ 
International Organization for Standardization developed the Open System 
Interconnection reference model, a popular networking reference model. 



(U) 
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Institute of Electrical and Electronics Engineers (IEEE) 8023. Institute of Electrical 
and Electronics Engineers LAN protocol that specifies an implementation of the physical 
layer and the MAC sublayer of the data link layer. Institute of Electrical and Electronics 
Engineers 802.3 uses Carrier Sense Multiple Access Collision Detect access at a variety 
of speeds over a variety of physical media. Extensions to the I Institute of Electrical and 
Electronics Engineers 802.3 standard specify implementations for Fast Ethernet. 



Open System Interconnection (OSI). International standardization program created by 
International Organization for Standardization and International Telecommunication 
Union Telecommunication Standardization Sector to develop standards for data 
networking that facilitate multi- vendor equipment interoperability. 



(b)(3)-P 



L. 86-36 



(b)(3)- 



=.L. 66-36 



(U) 
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Telecommunications Industry Association (TIA). Organization that develops 
standards relating to telecommunications technologies. Together, the 
Telecommunications Industry Association and the Electronic Industries Association have 
formalized standards, such as Electronic Industries Association and Telecommunications 
Industry Association -232, for the electrical characteristics of data transmission. 



(b){3)-P.L. 36-36 



(U) 
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Appendix J. Response to Management 

Comments (U) 



lb) (1) 

(b)(3)-P.L. 66-36 



- (S//Sf) Management Comments. A significant point of departure among Office of 
Inspector General Report assertions and NSA understanding, reflected within NS A's 




-(G) Management Comments . Although NSA will ag ree to conduct an independent 
assessment bf-TRAILBLA^g ^ fr e believe that it will validate all of 

the assertions made, in our responses to the Uttice ot inspector General recommendations. 

Furthermore, We dolftOt.affT** tfo»..r.i4ping1 Hn» r ittfrrvminlgintthgf wacte anA 

abuse occurred du ring the 



aunnj 
Jwhi 



which was conducted in an open fashion to provide the best benefit tor 



Agency mission and customers. More importantly, there has been no evidence 
documented during this Office of Inspector General investigation that supports that 
complaint. 



;(b> (3J-P.L. 86-36 



j$#8fy Audit Response. The report dopummfs that NSA snfint annroximatelj 
million to develop the TRAILBLAZEH | ■ 
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(JJffF&UQXManagem&nt Comments. NSA recommended that the audit report \ 
emphasis NSA's cooperation and responsiveness to Congress. \ 




(U/ /FOUO) -Management Comments. NSA recommended that the audit report 
emphasis that the THINTHREAD capability is valued by NSA. 
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-ffiffStt Management Comments. NSA stated that the draft rennrt emitter! critiraii 
infnnriafion 
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(b) (3)-P.L. 86- 
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(b) (3) -P.L. 86-36 
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-^■Management Comments. TRAILBLAZER welcomes an open review ob. 




- (S//SI) - Management Comments. NSA management does not agree with the DoD x - 
Office of Inspector General's assessment) 




-(S//SI).Audit Response. We acknowledge the feet that the cuirent scope of the 
TRAILBLAZER is to provide the information technology framework for the entire 
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(G) Management Comments. NSA managements stated that TRAILBLAZER and the; 
Technology Demonstration Platform have invested considerable effort to build a signal \ 
intelligence architecture that is open and scaleable, applies DoD, commercial, and NSK \ 

standards' »nH that is AncMmpntpA in DnTi Arrfoitenhirff Framftwnrlf vi^ws 




[ Information that we reviewed and previous Inspector General 

reports show that the NSA acquisition processes is not always consistent with the 
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-■fQ-guideliiies of DoD Directive 5000.2.1 



\(b) (1) 

\p) (3) -50 USC 40: 
(b) <3)-P.L. 86-3(1 



— tS^S^Management Comments. NSA management comments stated that the Executive 
Summary's ass ertion that NSA "disregarded solutions to urgent national security needs" 
is not accurate.^ 



(S//SI) Audit Response. NSA comments are inaccurate. Major issues raised in the 
management comments are addressed in the report, specifically the issue of 
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-tefManagement Comments. NSA management sta ted that the D6D ftigrfector General 

Rfinnrt's ™tafinn of theNTA Study's rac jimm^mi^ I \\ \ \ 
{also needs clarification. | / \ "\ r \ 



.' It 

-^maaagement Comments. NSA management t-. pmrrip.nfa sfaW ihni 'hhhmch tii 
Executive Summary indicated that TRAILBLAZER! / \\ \ 




(U//f©W^JHansgement Comments. NSA/manageraent comments stated that & e 
TRAILBLAZER has long-established plans fox external assessment of the Technology 
Demonstration Platform for preparation for Milestone B. The Independent Verification 
and Validation (IV&V) of 29 Evaluation Criteria is being conducted by NSA's \ \ 
independent Office of Corporate Assessments* Test and Technical Evaluation elebient 
(TTE). The Early Operational Assessment/and Operational Assessment will be \ \ 
performed by JITC, which had established^ presence in TRAILBLAZER spaces by \ 
November 2003. Results of both activities will be provided to the Milestone Decision 
Authority before Milestone B. / \ \ 

i ! - ' 

(U//ftrtJOX Audit Response. TRAILBLAZER postponed Milestone B scheduled 'for 
December 2004 because of technical issues with the Technology Demonstration 
Platform. February 2005 is the earliest date that TRAILBLAZER will be ready for 
MILESTONE B. / \ \ 

I \ \ 

(U7/¥0llO-)LManagement Comments. NSA management comments stated that the I 

Twsnlfg rvf fhft inH<>rM>nrft>nt ttsaes&nmf 



lenfoa" 

fwitr 
rzd04. 



II be provided to the MDA by Milestone B, 

Currently SCEUittUteu Kit UecetUDef . 

(STTSf) Management Comments. NSA management comments stated that the Kxeraitiye 
Summary's statement that TRAILBLAZER development "wasted 
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~{StiS£).of dollars" is not accurate. As the ^^Modernization Study observed, \ 
TRAILBLAZER is not only about digital "letwork expl oitation, but also en<fobnas'se s 
cultural transformation (people, processes, and policies) ! I \ 

lArid, although TRAILBLAZER is currently in. the 
developmental phase, it has already delivered significant capabilities. \ \ 

% \ 

■ (S//SI) A udit Response. The NSA management comments are inaccurate. Th e report 
Executive S uronfary does not claim that TRAILBLAZER development c< waste d*~\ 
~k >f dollars." Instead, this phrase is only used to accurately describe the \ 
specific hotline complaint allegation that initiated this audit. \ \ 
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^TS)JManagemeiit Comments. NSA management comments also questions the \ 
Executive Summary's statement that "NSA modified or suppressed / studies and \ 
j b id stated mat the 1 ; 

audit report did not identity where the intbrmation was obtained. 

(&) Audit Response. We have documented information to support this statement; 
however, because of fear of reprisal, we agreed to keep the sources anonymous. 



>i7ftgement Commen ts. The Office of Tnsnector General ftennrt's ritations nf\ 



were also incomolete and contained inaccuracies. The presentation of the results of the 



ill" 

TOP SECKET//COM3NT//2029n33 



DOOID i 3253346 . 



(b) (1) 

(b) (3) -50 USC 403 

TOP SECRET//COMINT//2Q2P1123 (woi-p.l. 86-36 



Audit Response. Our wording reflects information received from our sources. We 
reviewed all of the comments below and checked our sources and made adjustinents as 
required. \ 



112 

TOP SECRET//COftlINT//20391123 



Appendix K. Report Distribution (U) 



(U) 

Office of the Secretary of Defense 

Under Secretary of Defense for Acquisition, Technology, and Logistics 
Under Secretary of Defense (Comptroller) 
Under Secretary of Defense for Intelligence 

Assistant Secretary of Defense for Networks and Information Integration 

Other Defense Organization 

Director, National Security Agency 
Inspector General, National Security Agency 
Inspector General, Defense Intelligence Agency 
Inspector General, National Geospatial-Intelligence Agency 
Inspector General, National Reconnaissance Office 

Congressional Committees and Subcommittees, Chairman and 
Ranking Minority Member 

Senate Subcommittee on Defense, Committee on Appropriations 

Senate Committee on Armed Services 

Senate Select Committee on Intelligence 

House Subcommittee on Defense, Committee on Appropriations 

House Committee on Armed Services 

House Permanent Select Committee on Intelligence 
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' TCHHBCKinWDQMBfl BMO 
NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 



13 August 2004 



MEMORANDUM FOR INSPECTOR GENERAL, DEPARTMENT OF DEFENSE 

ATTN: Deputy Asritact IntpeotOf Qeogil far rnf.fflgwre AodJts 



SUBJECT: (U) Audit of the ItejuiremaafbftbsTRAI^ 
Syrian*, d*t*i June 18, 2004 {Projtct No. P2OO3AL-O10O) 



(U/ZBOy^Tiaiiic yon ftr the oppocumicy to «vfcw ud «Hnm«* oaths 
referenced draft report. CoaaoHdtted wifttgwnmt comnaeoti flom ocr Signal* 
Intelligence Directowte (SID), Acqoidlion Org miattoi i(DA) tod Tribtmtkm 
Techt»togyInfiw£nx^SCTY^Or£iita^ In Kidltloa, per 

your reqoett, a *e«trity cteisificttkm tevfew cf the dnftrwaitisfflrfojrf^jgnJbivB 



(b)(3>-B.L. 86-36 



Deputy ChWof Staff 



Em* 
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»"d USA 
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Mxtounding, reflected wiihta NSA'g rwpoMalietoy? concernf 



-tehUtaoughNSAwWi^toccaiuatata^^ 

| j we beSew thu it «H1 nlidtte ill of tM uierltons nude In our 
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conducted to an open Suhba to provide the best benefit &>r Ageocy olttioa ind 
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DR.V F%t HMMM lU-i 



t o p acREWCQ>ma y«i 
i 



116 



TO!* SECREI/^O»nJiT//20291123 



1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 



DOGID; 3253346 

Tor ^cmrft c ommmmud 



dv/raee) Pn>>c< No. k»<»aijdik> 

t&SfrPoP PIG feconatpd«ttog A.U j 
1 

(U) NSA R«*j!OMe: Nqncoiicor 



('a! (i) 
(bf{3j -E.L. 
86-36 



f or flEonin¥JOOMcnj!' | w - 

2 



117 

TOP SECRET//COMINiy/20291123 



DOCID a 32D3340 

TOr SECRET//COR1INT//3Q291123 



m (3i- 



P.L. 86-36 



TO P SECRCT//COMINTOX1 
(UflEOBQ) Protet D20Q3AL-010O 



\ J&RsATtcoMacuSa tbit tie foltowing terns be highiithWwitotbeOIGPiOjact 
\ Report 

THINIHREADaotbiHtvkvifoadbyNSA; 



(U) Target Dcte of CoB?kti«: Cocapfeie. 



3 



118 

TOP SECRETtfCOftP?fT//20291123 



or 

a 

a 
a 
a 
a 
a 

a 
a 
a 
n 
3 
3 

3 
3 
3 
3 



CIDi 325331G 



TOP SECIU5T//CO*lINT//202<m23 



(b) (1) ■ 

(b) (3)-P,L. 86-36 



Final Report 
Reference 



. -fSBS-DoD OK? BtqanmwxUtlon Aii I 



i i 



(U) NSA Xttpotmi Noaconcar 



Revised 
PS- 25 



tor 0BCM!r;^o>mjrM» 

4 



119 



TOP DECRET/i'COMDa , //20291123 



DOCIDt 3253346 



TOP SECRET f yCO»II?iT//20291123 



1 
1 
1 



-(b) (1) 



/ (b) (3)-P.L. 86-36 



■3T0P flBCTttTOU WUJIUU 1 
(UllfOW) PrqJ*ct No. D2303AJUI1M 




120 

TOP SECMDT//COaiINT//20391123 



OCID. 325334C 

TOP SECRETftCOftnNT//20291123 



(b) (1) 

(b) (3)-E.L. 86-36 



TO? 3ECRCT//COMINT//X1 - 
(U/*Dfi^JPioJ«t No. D2003AL-*1W 



TOf POOWBT/KX»IBaK«> 
6 



121 

TOP SECHET//OO^nNT//20291123 



DO.GID: 3253316 



top mcn&Titcomymiinnm 



(b) (1) 

(b) (3)-P.L. 86-36 



~te>DoD PIG Ktccmaca&rttai A3; 



(IDNSAXttpoMt: Conea 



(U)Tep(Dtte«CC(«9iHiQB: Complete. 



7 



122 

- TOP iSECRET//CO»IPfT//20'i!m i? ^ 



ff 



OCID; 3253346 



TOP SECIUST//COIMIKT//2Q291123 



1! 
1 



(b) (1) 

(b) <3)-P,L. 86-36 



1 \ 



Final Report 
Reference 



! I 
1 \ 



T O f SECm//t T ftftWty »» 
(UWP0B9) Project No. PJOCOAlr-dlOO 
-f6M)oP PIG Kecamafgmoo B.l: 



(10 NSA R*yooK Concur, with camoenU 



ntQ^IRAIISLAZER welconBj in open review of \ 


\ 
\ 

\ 

i 


\ 


\ 
\ 




\ 


■ i 



(U//R5BQ> At thta tiro*. M is aecesxry to *fte» lone tsEtcoKepdOBS ^ tie DoD 
OIG'I Executive Sanmtry sad Draft Report, u fcJtoWK \ 



l.-ffiffgj-Pint. HSA dog not tgrte wifeifaeDoD OKT» laMsasffiT 



TOP 8BCBETOCOMlW Wi»" 
8 



Revised 
p.35 



123 



TOf SECRET//CO^II>TT//30291123 



TOP SECRET/» t GOMINT//20291123 



(b) (1) 

(b) (3)-P.L. 



86-36 



top OEgRmw a iniw r /«i 



TO P S8Cim//C > q WTCT:t - 
9 



124 



TOr SECRET//COMINT 1 //20291123 



JDOCID: 3253346 



TOr SECRET/iCQMINT//2Q291123 



(b) (1) 

(b) [3)-P.L. 86-36 



Final report 
Reference 



{W/RroejJniJect No. D2MBAWWW 




• tet-SintNT Arcfttectiirfe md nflginwncrtrw THAlLflLAZER »ad TDP tare 
invwad ctaakSeatia effittt to boUd i.SIQINT »rt*is«cttire that Is wwlrteat with 
catoni DoD empfsiJ* oa op» »ccii£«ctore ud talibtifty, tbxt lppHes 
DoIVcommscaliNSA timdtxfo, tad Awm^ tvj> AwfcWhrm 

Frtmeworit (DoDAPl ucfcitectoe vtewt. 




page 77 



2r ( S // B ) Tie Execattve Scmmiry'i "j^ton tto NSA "dlxttuiea K>taft>M to area 



10 



125 

TOf aECRE r lW CU AU l ^ r //102J1123 



DOGID. 325334G 

TOP SECRET//COM1ICT//20291113 



■ (b)(1) 

(b) (3)-50 USC 
403 

(b) (3)-P.L. 

■ 86-36 

, TOP DBCRBT/^eOMnfr /flCl \\\ 
(IWregQ) Project No. DMO&UrOlM \ \\ \ 



\ 



\ 

3.-*eKTha OK* Reaott*« cj tiHan of tbe NTA Stadia icconuBegdiftoii [ 

mutt fo. cUrifisd. 1 \ 



4. XGTAhfrHarh Ihe Kncntfta SflTi"»Tr frf*^ TRAnflLAJBtF 



(iWrWOJ. T«rfet EWrt< of coepfetfoa: Miteftooe B is cumsttly whedoled &r 
December 2004. 



top sscK s rtiie au an tixi 
u 



126 

TOr SECRET//COanNT//2O301133 



)OOID. 325334G 



TOP SECRET//CO^CDS T T//2Q291123 



USD. ' 
(b> b 
8<S-3d 



a|£>3 
j'-P.L. 



itiv i»iijLUJi.itfco^tan'//xi 

(IMttSeO) Project No. D2#03AL-0I» 

(WFOW) DoD OIG Rfcwmnmrtitfaa R2; Proride t*e rwcto at the exftnuJ 
MtMBneat to fbe TKAJLBLAZER TMiBolOff Dtaaoettntkv Ptetfcnn Mli«taoe 
Dedrfoo Atriborftr bcneb making Ox- MStatane R iecfioa. 

(U}NSA Rr*poo«t: Concur 

*' 

(U//F©yO^As nratfoned fa tfre rejpocie to RecOTmyaflwtoa B.I, tbe FEO ud 
TRAILBLAZER inlcod to provide- the iesnlU of tie hAyjriwl assetsmeol to the 
TRA1LBLAZER MUwtooe Deettton Authority (MDA) for we to nukiof tbe Mifesone 
B4(XMtoaTte«ie^wiU»]»oteiBBttolbsDoDIO,teKSAIO^ 
ofGamlCoajuel. 

(U /ffOUO ) It *bouH ibo be noted tbu TRAUBLAZER his k>Df-«*iiMit£*d plus for 
extend tjaeetmect of the TOP for jttpimkm fee MflMtons B. Ub Iadepeocien! 
Verification tad ViEduion (TVJtV) of 29 Enluttfcxi Criierii 1* beto* conducted by 
NSA'« irvfepertfeet Office of Corpome Attatnwiti' Tot rod Techcfct] Enimtioa 
efcnsent (TTB). 11a Birly Optnflotttl Atteaacat md Operttbad Aarwntmt will t» 
performed by JITC, wfefch bid esttbHibed * presence ia TRAILBLA2ER iqkxs by 
November 2003. RstolU of both activUea win t* provided to tbe M3e«ooe Decision 
Authority before Milestone B. 

-feft-Tmet Pefe of conrictiow; Rc wfo of the iadepeadent Mtctsaent of 
~~„, | ^bepc(rrifedtotbeMPAbyMattto»B, 
contntJy tebedajed for December 2004. 
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(raTdeejJ^rjtt D«{* ofccanpfadoR: TWa «ctioa *Hi be completed by the MSwone 
B tirgetdfe rorrenflyictedutaJ for December 2004. 
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MEMORANDUM FOR DEPUTY ASSISTANT INSPECTOR GENERAL POR 
INTELLIGENCE AUDITS 

SUBJECT: (U//FOeeH)oD OIG Audit Report Requirements for the TRAILBLAZER 
and THINTHREAD Systems, dated December 15, 2004 (Report 05-INTEL- 
03, Project No. D2003AL-0100) - INFORMATION MEMORANDUM 



(U//TGi5Q^-ln response to the DoD OIG request for additional information on the 
TRAILBLAZER and THINTHREAD report, NSA/CSS provides consolidated corporate 
comments from our Signals Intelligence Directorate, Acquisition Organization, and 
Information Technology Infrastructure Services Organization (now the Information 
Technology Directorate). 

NSA/CSS Response: 



-^-Subsequent to the DoD OIG report, the TRAILBLAZER Milestone has been / 
scheduled for late in the fourth quarter of FY05 from the previously scheduled earlier 
MS B. Accordingly, this now allows sufficient time for the conduct of the assessment 
recommended by the DoD OIG. Ac ^gtg fXr ag cM<m m t will hA rmrerpH hv tWP"fff> 
rhift to the revised sr.hednfe.l 



<J.'he assessment will be finalized 



by May 2005. '-••.,, / 
Tf vnn havft any nnft«tinns nr need additional information, please contact/ 



MARIAN. O'CONNOR 
Chief of Staff 
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(b) (3)-P.L. 86-36 
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SUMMARY 

PURPOSE: 

(U//F©tJO) To provide the recommended PEO input to the consolidated NSA response regarding 
actions requested by the "final" Department of Defense (DoD) Office of Inspector General (OIG) 
report 05-INTEL-03, Requirements for TRAILBLAZER and THINTHREAD Systems of 15 
December 2004. 

(h) (3)-£.L. 86-36 

BACKGROUND /DISCUSSION: / "\ ~ — _ 

(U//FOTJ6} In their June '04 Draft ofjfche Audi t Report, the DoD OIG made the Yollowing 

recommendation. "Designate a te am* to assess 

the operational requirements of the TRAILBLAZER Technology 



Demonstration .Platform,'., ■ 

In response to this draft, in August, the Agency concurred "with comments." The following 
is an excerpt from' those comments; " The Program Executive Office (PEO) is taking th^ lead in 
establishing, an independent review tea m for performing this assessment, with the intention 

that it s results will be completed in time 

Milestone B documentation." 



(gTAt the time of this statement (Aug '04>, the TRAILBLAZER Milestone B (MSB) was 
scheduled for December '04. When the final report was published, the PEO Assessment had not 
yet begun. Concerned that the assessment could not be completed in time to support a 
December milestone, the DoD OIG requested via the final report, that they be provided; "NSA 
plans to eliminate the cost and schedule risks for completing the assessment." 

-££)-Since release of the final Audit Report, a DIRNSA-Chartered Transformational Advisory 
Panel (TAP) recommended TRAILBLAZER be rebaselined. The MSB is now planned for late 
Fourth Quarter FY05. 
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and 



(XJ/fi?Oi5QX$he development of this response has been coordinated witij 
the TEAILBLAZER Program Management Office. \ 

RECOMMENDATION: , \ 
1. (U//1TO A formal -Risk Mitigation Plan is not recommended. The P£p is 
committed to conducting the assessment. The team is currently being form ed, a 
Mck-off mtg,is bl anned for March, and the team is expected to report to Mr. 



NLT May 31st. The cost and schedule impact of conducting the assessment 



pose very low risk to the Transformational Programs. 



2. (U//F©yOJ Recommend the response, provided as an attachment, be forwarded to 
the DoD OIG as part of the Agency's consolidated response to the Final Report. 
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